Google and Microsoft Pull Mod Header With 1.6 Million Installs After Dormant Collector Found

Summary: Google and Microsoft removed ModHeader, a header-editing extension with roughly 1.6 million installs across Chrome and Edge, after Stripe OLT found a dormant browsing-history collector inside the official store version, verified against Google's Web Store signature. The collector was gated off by an empty allow-list, but the code builds a device fingerprint, encrypts up to 1000 browsed domains, and is set to post them daily to api.stanfordstudies[.]com; Microsoft pulled the Edge listing on July 3 and Google removed the Chrome one on July 10.
Bottom line: The pipeline is already on 1.6 million machines - hardcoded key, endpoint, and scheduler included - and switching it on takes only an ordinary update that populates the empty allow-list, with no new permissions and no click from the user. Automated checkers rated ModHeader as high as 95 out of 100 on risk while the collector sat in the code.

Read the original at The Hacker News ↗